@stratum-hq/db-adapters 0.1.0

package/dist/__tests__/rls-manager.test.js

@@ -0,0 +1,180 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const manager_js_1 = require("../rls/manager.js");
+// ---------------------------------------------------------------------------
+// Mock pg.PoolClient
+// ---------------------------------------------------------------------------
+function makeMockClient() {
+    return {
+        query: vitest_1.vi.fn().mockResolvedValue({ rows: [], rowCount: 0 }),
+    };
+}
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+(0, vitest_1.describe)("RLS Manager", () => {
+    let client;
+    (0, vitest_1.beforeEach)(() => {
+        client = makeMockClient();
+    });
+    // -----------------------------------------------------------------------
+    // Table name validation
+    // -----------------------------------------------------------------------
+    (0, vitest_1.describe)("table name validation", () => {
+        (0, vitest_1.it)("rejects names containing SQL injection attempts", async () => {
+            await (0, vitest_1.expect)((0, manager_js_1.createPolicy)(client, "users; DROP TABLE")).rejects.toThrow("Invalid table name");
+            await (0, vitest_1.expect)((0, manager_js_1.dropPolicy)(client, "users; DROP TABLE")).rejects.toThrow("Invalid table name");
+            await (0, vitest_1.expect)((0, manager_js_1.enableRLS)(client, "users; DROP TABLE")).rejects.toThrow("Invalid table name");
+            await (0, vitest_1.expect)((0, manager_js_1.disableRLS)(client, "users; DROP TABLE")).rejects.toThrow("Invalid table name");
+        });
+        (0, vitest_1.it)("rejects names with spaces", async () => {
+            await (0, vitest_1.expect)((0, manager_js_1.createPolicy)(client, "my table")).rejects.toThrow("Invalid table name");
+        });
+        (0, vitest_1.it)("rejects names starting with a digit", async () => {
+            await (0, vitest_1.expect)((0, manager_js_1.createPolicy)(client, "1users")).rejects.toThrow("Invalid table name");
+        });
+        (0, vitest_1.it)("rejects names with hyphens", async () => {
+            await (0, vitest_1.expect)((0, manager_js_1.createPolicy)(client, "my-table")).rejects.toThrow("Invalid table name");
+        });
+        (0, vitest_1.it)("rejects names with parentheses", async () => {
+            await (0, vitest_1.expect)((0, manager_js_1.createPolicy)(client, "users()")).rejects.toThrow("Invalid table name");
+        });
+        (0, vitest_1.it)("rejects empty string", async () => {
+            await (0, vitest_1.expect)((0, manager_js_1.createPolicy)(client, "")).rejects.toThrow("Invalid table name");
+        });
+        (0, vitest_1.it)("accepts simple alphanumeric names", async () => {
+            client.query.mockResolvedValueOnce({
+                rows: [{ count: "0" }],
+            });
+            await (0, vitest_1.expect)((0, manager_js_1.createPolicy)(client, "users")).resolves.toBeUndefined();
+        });
+        (0, vitest_1.it)("accepts names with underscores", async () => {
+            client.query.mockResolvedValueOnce({
+                rows: [{ count: "0" }],
+            });
+            await (0, vitest_1.expect)((0, manager_js_1.createPolicy)(client, "tenant_data")).resolves.toBeUndefined();
+        });
+        (0, vitest_1.it)("accepts names starting with underscore", async () => {
+            client.query.mockResolvedValueOnce({
+                rows: [{ count: "0" }],
+            });
+            await (0, vitest_1.expect)((0, manager_js_1.createPolicy)(client, "_internal")).resolves.toBeUndefined();
+        });
+    });
+    // -----------------------------------------------------------------------
+    // createPolicy
+    // -----------------------------------------------------------------------
+    (0, vitest_1.describe)("createPolicy", () => {
+        (0, vitest_1.it)("checks for existing policy before creating", async () => {
+            client.query.mockResolvedValueOnce({
+                rows: [{ count: "0" }],
+            });
+            await (0, manager_js_1.createPolicy)(client, "orders");
+            const calls = client.query.mock.calls;
+            (0, vitest_1.expect)(calls).toHaveLength(2);
+            // First call: check pg_policies
+            (0, vitest_1.expect)(calls[0][0]).toContain("pg_policies");
+            (0, vitest_1.expect)(calls[0][0]).toContain("tenant_isolation");
+            (0, vitest_1.expect)(calls[0][1]).toEqual(["orders"]);
+            // Second call: CREATE POLICY
+            (0, vitest_1.expect)(calls[1][0]).toContain("CREATE POLICY tenant_isolation ON orders");
+            (0, vitest_1.expect)(calls[1][0]).toContain("current_setting('app.current_tenant_id')");
+        });
+        (0, vitest_1.it)("skips creation when policy already exists", async () => {
+            client.query.mockResolvedValueOnce({
+                rows: [{ count: "1" }],
+            });
+            await (0, manager_js_1.createPolicy)(client, "orders");
+            const calls = client.query.mock.calls;
+            // Only the SELECT check, no CREATE POLICY
+            (0, vitest_1.expect)(calls).toHaveLength(1);
+            (0, vitest_1.expect)(calls[0][0]).toContain("pg_policies");
+        });
+        (0, vitest_1.it)("uses the validated table name in the SQL", async () => {
+            client.query.mockResolvedValueOnce({
+                rows: [{ count: "0" }],
+            });
+            await (0, manager_js_1.createPolicy)(client, "user_accounts");
+            const createCall = client.query.mock
+                .calls[1][0];
+            (0, vitest_1.expect)(createCall).toContain("ON user_accounts USING");
+        });
+    });
+    // -----------------------------------------------------------------------
+    // dropPolicy
+    // -----------------------------------------------------------------------
+    (0, vitest_1.describe)("dropPolicy", () => {
+        (0, vitest_1.it)("generates correct DROP POLICY SQL", async () => {
+            await (0, manager_js_1.dropPolicy)(client, "orders");
+            const call = client.query.mock.calls[0];
+            (0, vitest_1.expect)(call[0]).toBe("DROP POLICY IF EXISTS tenant_isolation ON orders");
+        });
+        (0, vitest_1.it)("uses the validated table name", async () => {
+            await (0, manager_js_1.dropPolicy)(client, "tenant_invoices");
+            const sql = client.query.mock.calls[0][0];
+            (0, vitest_1.expect)(sql).toContain("ON tenant_invoices");
+        });
+    });
+    // -----------------------------------------------------------------------
+    // enableRLS
+    // -----------------------------------------------------------------------
+    (0, vitest_1.describe)("enableRLS", () => {
+        (0, vitest_1.it)("generates correct ALTER TABLE statements", async () => {
+            await (0, manager_js_1.enableRLS)(client, "products");
+            const calls = client.query.mock.calls;
+            (0, vitest_1.expect)(calls).toHaveLength(2);
+            (0, vitest_1.expect)(calls[0][0]).toBe("ALTER TABLE products ENABLE ROW LEVEL SECURITY");
+            (0, vitest_1.expect)(calls[1][0]).toBe("ALTER TABLE products FORCE ROW LEVEL SECURITY");
+        });
+    });
+    // -----------------------------------------------------------------------
+    // disableRLS
+    // -----------------------------------------------------------------------
+    (0, vitest_1.describe)("disableRLS", () => {
+        (0, vitest_1.it)("generates correct ALTER TABLE statements for disabling", async () => {
+            await (0, manager_js_1.disableRLS)(client, "products");
+            const calls = client.query.mock.calls;
+            (0, vitest_1.expect)(calls).toHaveLength(2);
+            (0, vitest_1.expect)(calls[0][0]).toBe("ALTER TABLE products NO FORCE ROW LEVEL SECURITY");
+            (0, vitest_1.expect)(calls[1][0]).toBe("ALTER TABLE products DISABLE ROW LEVEL SECURITY");
+        });
+    });
+    // -----------------------------------------------------------------------
+    // isRLSEnabled
+    // -----------------------------------------------------------------------
+    (0, vitest_1.describe)("isRLSEnabled", () => {
+        (0, vitest_1.it)("queries pg_class with the table name as a parameter", async () => {
+            client.query.mockResolvedValueOnce({
+                rows: [{ relrowsecurity: true }],
+            });
+            await (0, manager_js_1.isRLSEnabled)(client, "orders");
+            const call = client.query.mock.calls[0];
+            (0, vitest_1.expect)(call[0]).toContain("pg_class");
+            (0, vitest_1.expect)(call[0]).toContain("relrowsecurity");
+            (0, vitest_1.expect)(call[1]).toEqual(["orders"]);
+        });
+        (0, vitest_1.it)("returns true when RLS is enabled", async () => {
+            client.query.mockResolvedValueOnce({
+                rows: [{ relrowsecurity: true }],
+            });
+            const result = await (0, manager_js_1.isRLSEnabled)(client, "orders");
+            (0, vitest_1.expect)(result).toBe(true);
+        });
+        (0, vitest_1.it)("returns false when RLS is disabled", async () => {
+            client.query.mockResolvedValueOnce({
+                rows: [{ relrowsecurity: false }],
+            });
+            const result = await (0, manager_js_1.isRLSEnabled)(client, "orders");
+            (0, vitest_1.expect)(result).toBe(false);
+        });
+        (0, vitest_1.it)("returns false when table does not exist (no rows)", async () => {
+            client.query.mockResolvedValueOnce({
+                rows: [],
+            });
+            const result = await (0, manager_js_1.isRLSEnabled)(client, "nonexistent");
+            (0, vitest_1.expect)(result).toBe(false);
+        });
+    });
+});
+//# sourceMappingURL=rls-manager.test.js.map

package/dist/__tests__/rls-manager.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls-manager.test.js","sourceRoot":"","sources":["../../src/__tests__/rls-manager.test.ts"],"names":[],"mappings":";;AAAA,mCAA8D;AAC9D,kDAM2B;AAE3B,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,SAAS,cAAc;IACrB,OAAO;QACL,KAAK,EAAE,WAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;KACtB,CAAC;AAC1C,CAAC;AAED,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,IAAA,iBAAQ,EAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,IAAI,MAAyC,CAAC;IAE9C,IAAA,mBAAU,EAAC,GAAG,EAAE;QACd,MAAM,GAAG,cAAc,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,wBAAwB;IACxB,0EAA0E;IAE1E,IAAA,iBAAQ,EAAC,uBAAuB,EAAE,GAAG,EAAE;QACrC,IAAA,WAAE,EAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;YAC/D,MAAM,IAAA,eAAM,EAAC,IAAA,yBAAY,EAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACrE,oBAAoB,CACrB,CAAC;YACF,MAAM,IAAA,eAAM,EAAC,IAAA,uBAAU,EAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACnE,oBAAoB,CACrB,CAAC;YACF,MAAM,IAAA,eAAM,EAAC,IAAA,sBAAS,EAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAClE,oBAAoB,CACrB,CAAC;YACF,MAAM,IAAA,eAAM,EAAC,IAAA,uBAAU,EAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACnE,oBAAoB,CACrB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;YACzC,MAAM,IAAA,eAAM,EAAC,IAAA,yBAAY,EAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC5D,oBAAoB,CACrB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACnD,MAAM,IAAA,eAAM,EAAC,IAAA,yBAAY,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC1D,oBAAoB,CACrB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,IAAA,eAAM,EAAC,IAAA,yBAAY,EAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC5D,oBAAoB,CACrB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;YAC9C,MAAM,IAAA,eAAM,EAAC,IAAA,yBAAY,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC3D,oBAAoB,CACrB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;YACpC,MAAM,IAAA,eAAM,EAAC,IAAA,yBAAY,EAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACpD,oBAAoB,CACrB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;YAChD,MAAM,CAAC,KAAkC,CAAC,qBAAqB,CAAC;gBAC/D,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;aACvB,CAAC,CAAC;YACH,MAAM,IAAA,eAAM,EAAC,IAAA,yBAAY,EAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;YAC7C,MAAM,CAAC,KAAkC,CAAC,qBAAqB,CAAC;gBAC/D,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;aACvB,CAAC,CAAC;YACH,MAAM,IAAA,eAAM,EACV,IAAA,yBAAY,EAAC,MAAM,EAAE,aAAa,CAAC,CACpC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,CAAC,KAAkC,CAAC,qBAAqB,CAAC;gBAC/D,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;aACvB,CAAC,CAAC;YACH,MAAM,IAAA,eAAM,EAAC,IAAA,yBAAY,EAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC3E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,eAAe;IACf,0EAA0E;IAE1E,IAAA,iBAAQ,EAAC,cAAc,EAAE,GAAG,EAAE;QAC5B,IAAA,WAAE,EAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,CAAC,KAAkC,CAAC,qBAAqB,CAAC;gBAC/D,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;aACvB,CAAC,CAAC;YAEH,MAAM,IAAA,yBAAY,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAErC,MAAM,KAAK,GAAI,MAAM,CAAC,KAAkC,CAAC,IAAI,CAAC,KAAK,CAAC;YACpE,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAE9B,gCAAgC;YAChC,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YAC7C,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;YAClD,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAExC,6BAA6B;YAC7B,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;YAC1E,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;YACxD,MAAM,CAAC,KAAkC,CAAC,qBAAqB,CAAC;gBAC/D,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;aACvB,CAAC,CAAC;YAEH,MAAM,IAAA,yBAAY,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAErC,MAAM,KAAK,GAAI,MAAM,CAAC,KAAkC,CAAC,IAAI,CAAC,KAAK,CAAC;YACpE,0CAA0C;YAC1C,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,CAAC,KAAkC,CAAC,qBAAqB,CAAC;gBAC/D,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;aACvB,CAAC,CAAC;YAEH,MAAM,IAAA,yBAAY,EAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YAE5C,MAAM,UAAU,GAAI,MAAM,CAAC,KAAkC,CAAC,IAAI;iBAC/D,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACf,IAAA,eAAM,EAAC,UAAU,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,aAAa;IACb,0EAA0E;IAE1E,IAAA,iBAAQ,EAAC,YAAY,EAAE,GAAG,EAAE;QAC1B,IAAA,WAAE,EAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;YACjD,MAAM,IAAA,uBAAU,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAEnC,MAAM,IAAI,GAAI,MAAM,CAAC,KAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACtE,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAClB,kDAAkD,CACnD,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;YAC7C,MAAM,IAAA,uBAAU,EAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;YAE5C,MAAM,GAAG,GAAI,MAAM,CAAC,KAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxE,IAAA,eAAM,EAAC,GAAG,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,YAAY;IACZ,0EAA0E;IAE1E,IAAA,iBAAQ,EAAC,WAAW,EAAE,GAAG,EAAE;QACzB,IAAA,WAAE,EAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;YACxD,MAAM,IAAA,sBAAS,EAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAEpC,MAAM,KAAK,GAAI,MAAM,CAAC,KAAkC,CAAC,IAAI,CAAC,KAAK,CAAC;YACpE,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACtB,gDAAgD,CACjD,CAAC;YACF,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACtB,+CAA+C,CAChD,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,aAAa;IACb,0EAA0E;IAE1E,IAAA,iBAAQ,EAAC,YAAY,EAAE,GAAG,EAAE;QAC1B,IAAA,WAAE,EAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;YACtE,MAAM,IAAA,uBAAU,EAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAErC,MAAM,KAAK,GAAI,MAAM,CAAC,KAAkC,CAAC,IAAI,CAAC,KAAK,CAAC;YACpE,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACtB,kDAAkD,CACnD,CAAC;YACF,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACtB,iDAAiD,CAClD,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,eAAe;IACf,0EAA0E;IAE1E,IAAA,iBAAQ,EAAC,cAAc,EAAE,GAAG,EAAE;QAC5B,IAAA,WAAE,EAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,CAAC,KAAkC,CAAC,qBAAqB,CAAC;gBAC/D,IAAI,EAAE,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;aACjC,CAAC,CAAC;YAEH,MAAM,IAAA,yBAAY,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAErC,MAAM,IAAI,GAAI,MAAM,CAAC,KAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACtE,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YACtC,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAC5C,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;YAC/C,MAAM,CAAC,KAAkC,CAAC,qBAAqB,CAAC;gBAC/D,IAAI,EAAE,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;aACjC,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,IAAA,yBAAY,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACpD,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YACjD,MAAM,CAAC,KAAkC,CAAC,qBAAqB,CAAC;gBAC/D,IAAI,EAAE,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;aAClC,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,IAAA,yBAAY,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACpD,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;YAChE,MAAM,CAAC,KAAkC,CAAC,qBAAqB,CAAC;gBAC/D,IAAI,EAAE,EAAE;aACT,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,IAAA,yBAAY,EAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YACzD,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/rls-session.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=rls-session.test.d.ts.map

package/dist/__tests__/rls-session.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls-session.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/rls-session.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/rls-session.test.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const session_js_1 = require("../rls/session.js");
+// ---------------------------------------------------------------------------
+// Mock pg.PoolClient
+// ---------------------------------------------------------------------------
+function makeMockClient() {
+    return {
+        query: vitest_1.vi.fn().mockResolvedValue({ rows: [], rowCount: 0 }),
+    };
+}
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+(0, vitest_1.describe)("RLS Session", () => {
+    let client;
+    (0, vitest_1.beforeEach)(() => {
+        client = makeMockClient();
+    });
+    // -----------------------------------------------------------------------
+    // setTenantContext
+    // -----------------------------------------------------------------------
+    (0, vitest_1.describe)("setTenantContext", () => {
+        (0, vitest_1.it)("sets the correct session variable via set_config", async () => {
+            await (0, session_js_1.setTenantContext)(client, "tenant-abc-123");
+            const call = client.query.mock.calls[0];
+            (0, vitest_1.expect)(call[0]).toBe("SELECT set_config('app.current_tenant_id', $1, true)");
+            (0, vitest_1.expect)(call[1]).toEqual(["tenant-abc-123"]);
+        });
+        (0, vitest_1.it)("passes the tenant ID as a parameterized value", async () => {
+            await (0, session_js_1.setTenantContext)(client, "f47ac10b-58cc-4372-a567-0e02b2c3d479");
+            const params = client.query.mock
+                .calls[0][1];
+            (0, vitest_1.expect)(params).toEqual(["f47ac10b-58cc-4372-a567-0e02b2c3d479"]);
+        });
+        (0, vitest_1.it)("uses transaction-local scope (third arg true)", async () => {
+            await (0, session_js_1.setTenantContext)(client, "any-tenant");
+            const sql = client.query.mock.calls[0][0];
+            // The third argument to set_config is `true`, meaning transaction-local
+            (0, vitest_1.expect)(sql).toContain("true");
+        });
+    });
+    // -----------------------------------------------------------------------
+    // resetTenantContext
+    // -----------------------------------------------------------------------
+    (0, vitest_1.describe)("resetTenantContext", () => {
+        (0, vitest_1.it)("resets the session variable", async () => {
+            await (0, session_js_1.resetTenantContext)(client);
+            const call = client.query.mock.calls[0];
+            (0, vitest_1.expect)(call[0]).toBe("RESET app.current_tenant_id");
+        });
+        (0, vitest_1.it)("does not pass any parameters", async () => {
+            await (0, session_js_1.resetTenantContext)(client);
+            const call = client.query.mock.calls[0];
+            // Only the SQL string, no params array
+            (0, vitest_1.expect)(call).toHaveLength(1);
+        });
+    });
+    // -----------------------------------------------------------------------
+    // getCurrentTenantId
+    // -----------------------------------------------------------------------
+    (0, vitest_1.describe)("getCurrentTenantId", () => {
+        (0, vitest_1.it)("reads the session variable via current_setting", async () => {
+            client.query.mockResolvedValueOnce({
+                rows: [{ current_setting: "tenant-xyz" }],
+            });
+            await (0, session_js_1.getCurrentTenantId)(client);
+            const sql = client.query.mock.calls[0][0];
+            (0, vitest_1.expect)(sql).toContain("current_setting('app.current_tenant_id'");
+        });
+        (0, vitest_1.it)("returns the tenant ID when set", async () => {
+            client.query.mockResolvedValueOnce({
+                rows: [{ current_setting: "tenant-xyz" }],
+            });
+            const result = await (0, session_js_1.getCurrentTenantId)(client);
+            (0, vitest_1.expect)(result).toBe("tenant-xyz");
+        });
+        (0, vitest_1.it)("returns null when the setting is empty string", async () => {
+            client.query.mockResolvedValueOnce({
+                rows: [{ current_setting: "" }],
+            });
+            const result = await (0, session_js_1.getCurrentTenantId)(client);
+            (0, vitest_1.expect)(result).toBeNull();
+        });
+        (0, vitest_1.it)("returns null when rows are empty", async () => {
+            client.query.mockResolvedValueOnce({
+                rows: [],
+            });
+            const result = await (0, session_js_1.getCurrentTenantId)(client);
+            (0, vitest_1.expect)(result).toBeNull();
+        });
+        (0, vitest_1.it)("returns null when current_setting is null", async () => {
+            client.query.mockResolvedValueOnce({
+                rows: [{ current_setting: null }],
+            });
+            const result = await (0, session_js_1.getCurrentTenantId)(client);
+            (0, vitest_1.expect)(result).toBeNull();
+        });
+    });
+});
+//# sourceMappingURL=rls-session.test.js.map

package/dist/__tests__/rls-session.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls-session.test.js","sourceRoot":"","sources":["../../src/__tests__/rls-session.test.ts"],"names":[],"mappings":";;AAAA,mCAA8D;AAC9D,kDAI2B;AAE3B,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,SAAS,cAAc;IACrB,OAAO;QACL,KAAK,EAAE,WAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;KACtB,CAAC;AAC1C,CAAC;AAED,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,IAAA,iBAAQ,EAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,IAAI,MAAyC,CAAC;IAE9C,IAAA,mBAAU,EAAC,GAAG,EAAE;QACd,MAAM,GAAG,cAAc,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,mBAAmB;IACnB,0EAA0E;IAE1E,IAAA,iBAAQ,EAAC,kBAAkB,EAAE,GAAG,EAAE;QAChC,IAAA,WAAE,EAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;YAChE,MAAM,IAAA,6BAAgB,EAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAEjD,MAAM,IAAI,GAAI,MAAM,CAAC,KAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACtE,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAClB,sDAAsD,CACvD,CAAC;YACF,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,IAAA,6BAAgB,EAAC,MAAM,EAAE,sCAAsC,CAAC,CAAC;YAEvE,MAAM,MAAM,GAAI,MAAM,CAAC,KAAkC,CAAC,IAAI;iBAC3D,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACf,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,IAAA,6BAAgB,EAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YAE7C,MAAM,GAAG,GAAI,MAAM,CAAC,KAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxE,wEAAwE;YACxE,IAAA,eAAM,EAAC,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,qBAAqB;IACrB,0EAA0E;IAE1E,IAAA,iBAAQ,EAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,IAAA,WAAE,EAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;YAC3C,MAAM,IAAA,+BAAkB,EAAC,MAAM,CAAC,CAAC;YAEjC,MAAM,IAAI,GAAI,MAAM,CAAC,KAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACtE,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,IAAA,+BAAkB,EAAC,MAAM,CAAC,CAAC;YAEjC,MAAM,IAAI,GAAI,MAAM,CAAC,KAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACtE,uCAAuC;YACvC,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,qBAAqB;IACrB,0EAA0E;IAE1E,IAAA,iBAAQ,EAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,IAAA,WAAE,EAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,CAAC,KAAkC,CAAC,qBAAqB,CAAC;gBAC/D,IAAI,EAAE,CAAC,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC;aAC1C,CAAC,CAAC;YAEH,MAAM,IAAA,+BAAkB,EAAC,MAAM,CAAC,CAAC;YAEjC,MAAM,GAAG,GAAI,MAAM,CAAC,KAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxE,IAAA,eAAM,EAAC,GAAG,CAAC,CAAC,SAAS,CAAC,yCAAyC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;YAC7C,MAAM,CAAC,KAAkC,CAAC,qBAAqB,CAAC;gBAC/D,IAAI,EAAE,CAAC,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC;aAC1C,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,IAAA,+BAAkB,EAAC,MAAM,CAAC,CAAC;YAChD,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,CAAC,KAAkC,CAAC,qBAAqB,CAAC;gBAC/D,IAAI,EAAE,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;aAChC,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,IAAA,+BAAkB,EAAC,MAAM,CAAC,CAAC;YAChD,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;YAC/C,MAAM,CAAC,KAAkC,CAAC,qBAAqB,CAAC;gBAC/D,IAAI,EAAE,EAAE;aACT,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,IAAA,+BAAkB,EAAC,MAAM,CAAC,CAAC;YAChD,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;YACxD,MAAM,CAAC,KAAkC,CAAC,qBAAqB,CAAC;gBAC/D,IAAI,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;aAClC,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,IAAA,+BAAkB,EAAC,MAAM,CAAC,CAAC;YAChD,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/schema-manager.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=schema-manager.test.d.ts.map

package/dist/__tests__/schema-manager.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-manager.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/schema-manager.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/schema-manager.test.js

@@ -0,0 +1,116 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const manager_js_1 = require("../schema/manager.js");
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function makeClient(queryResults = {}) {
+    const query = vitest_1.vi.fn(async (sql) => {
+        // Return the configured result or a sensible default
+        for (const [pattern, result] of Object.entries(queryResults)) {
+            if (sql.includes(pattern)) {
+                return result;
+            }
+        }
+        return { rows: [], rowCount: 0 };
+    });
+    return { query };
+}
+// ---------------------------------------------------------------------------
+// tenantSchemaName
+// ---------------------------------------------------------------------------
+(0, vitest_1.describe)("tenantSchemaName", () => {
+    (0, vitest_1.it)("prepends tenant_ to a simple slug", () => {
+        (0, vitest_1.expect)((0, manager_js_1.tenantSchemaName)("acme")).toBe("tenant_acme");
+    });
+    (0, vitest_1.it)("handles slugs with underscores and digits", () => {
+        (0, vitest_1.expect)((0, manager_js_1.tenantSchemaName)("acme_corp_2024")).toBe("tenant_acme_corp_2024");
+    });
+});
+// ---------------------------------------------------------------------------
+// createSchema
+// ---------------------------------------------------------------------------
+(0, vitest_1.describe)("createSchema", () => {
+    (0, vitest_1.it)("executes CREATE SCHEMA IF NOT EXISTS with the correct name", async () => {
+        const client = makeClient();
+        await (0, manager_js_1.createSchema)(client, "acme");
+        (0, vitest_1.expect)(client.query).toHaveBeenCalledWith("CREATE SCHEMA IF NOT EXISTS tenant_acme");
+    });
+    (0, vitest_1.it)("rejects an invalid slug that produces an invalid schema name", async () => {
+        const client = makeClient();
+        // Injecting SQL-special characters via an invalid slug
+        await (0, vitest_1.expect)((0, manager_js_1.createSchema)(client, "bad; DROP TABLE tenants--")).rejects.toThrow("Invalid schema name");
+    });
+});
+// ---------------------------------------------------------------------------
+// dropSchema
+// ---------------------------------------------------------------------------
+(0, vitest_1.describe)("dropSchema", () => {
+    (0, vitest_1.it)("executes DROP SCHEMA IF EXISTS … CASCADE", async () => {
+        const client = makeClient();
+        await (0, manager_js_1.dropSchema)(client, "acme");
+        (0, vitest_1.expect)(client.query).toHaveBeenCalledWith("DROP SCHEMA IF EXISTS tenant_acme CASCADE");
+    });
+});
+// ---------------------------------------------------------------------------
+// schemaExists
+// ---------------------------------------------------------------------------
+(0, vitest_1.describe)("schemaExists", () => {
+    (0, vitest_1.it)("returns true when count > 0", async () => {
+        const client = makeClient({ pg_namespace: { rows: [{ count: "1" }], rowCount: 1 } });
+        const result = await (0, manager_js_1.schemaExists)(client, "acme");
+        (0, vitest_1.expect)(result).toBe(true);
+    });
+    (0, vitest_1.it)("returns false when count is 0", async () => {
+        const client = makeClient({ pg_namespace: { rows: [{ count: "0" }], rowCount: 1 } });
+        const result = await (0, manager_js_1.schemaExists)(client, "acme");
+        (0, vitest_1.expect)(result).toBe(false);
+    });
+    (0, vitest_1.it)("uses parameterized query with the full schema name", async () => {
+        const client = makeClient({ pg_namespace: { rows: [{ count: "0" }], rowCount: 1 } });
+        await (0, manager_js_1.schemaExists)(client, "acme");
+        (0, vitest_1.expect)(client.query).toHaveBeenCalledWith(vitest_1.expect.stringContaining("pg_namespace"), ["tenant_acme"]);
+    });
+});
+// ---------------------------------------------------------------------------
+// listTenantSchemas
+// ---------------------------------------------------------------------------
+(0, vitest_1.describe)("listTenantSchemas", () => {
+    (0, vitest_1.it)("returns schema names from pg_namespace", async () => {
+        const client = makeClient({
+            pg_namespace: {
+                rows: [{ nspname: "tenant_acme" }, { nspname: "tenant_beta" }],
+                rowCount: 2,
+            },
+        });
+        const schemas = await (0, manager_js_1.listTenantSchemas)(client);
+        (0, vitest_1.expect)(schemas).toEqual(["tenant_acme", "tenant_beta"]);
+    });
+    (0, vitest_1.it)("returns empty array when no tenant schemas exist", async () => {
+        const client = makeClient({
+            pg_namespace: { rows: [], rowCount: 0 },
+        });
+        const schemas = await (0, manager_js_1.listTenantSchemas)(client);
+        (0, vitest_1.expect)(schemas).toEqual([]);
+    });
+});
+// ---------------------------------------------------------------------------
+// replicateTableToSchema
+// ---------------------------------------------------------------------------
+(0, vitest_1.describe)("replicateTableToSchema", () => {
+    (0, vitest_1.it)("executes CREATE TABLE … LIKE public.tableName", async () => {
+        const client = makeClient();
+        await (0, manager_js_1.replicateTableToSchema)(client, "orders", "tenant_acme");
+        (0, vitest_1.expect)(client.query).toHaveBeenCalledWith("CREATE TABLE IF NOT EXISTS tenant_acme.orders (LIKE public.orders INCLUDING ALL)");
+    });
+    (0, vitest_1.it)("rejects an invalid table name", async () => {
+        const client = makeClient();
+        await (0, vitest_1.expect)((0, manager_js_1.replicateTableToSchema)(client, "orders; DROP TABLE tenants--", "tenant_acme")).rejects.toThrow("Invalid table name");
+    });
+    (0, vitest_1.it)("rejects an invalid schema name", async () => {
+        const client = makeClient();
+        await (0, vitest_1.expect)((0, manager_js_1.replicateTableToSchema)(client, "orders", "bad schema name")).rejects.toThrow("Invalid schema name");
+    });
+});
+//# sourceMappingURL=schema-manager.test.js.map

package/dist/__tests__/schema-manager.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-manager.test.js","sourceRoot":"","sources":["../../src/__tests__/schema-manager.test.ts"],"names":[],"mappings":";;AAAA,mCAA8D;AAC9D,qDAO8B;AAG9B,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,UAAU,CAAC,eAAwC,EAAE;IAC5D,MAAM,KAAK,GAAG,WAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QACxC,qDAAqD;QACrD,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7D,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1B,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACnC,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAA8B,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,IAAA,iBAAQ,EAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,IAAA,WAAE,EAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,IAAA,eAAM,EAAC,IAAA,6BAAgB,EAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,IAAA,eAAM,EAAC,IAAA,6BAAgB,EAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,IAAA,iBAAQ,EAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,IAAA,WAAE,EAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,IAAA,yBAAY,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,IAAA,eAAM,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CACvC,yCAAyC,CAC1C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,uDAAuD;QACvD,MAAM,IAAA,eAAM,EAAC,IAAA,yBAAY,EAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC7E,qBAAqB,CACtB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,IAAA,iBAAQ,EAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,IAAA,WAAE,EAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,IAAA,uBAAU,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CACvC,2CAA2C,CAC5C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,IAAA,iBAAQ,EAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,IAAA,WAAE,EAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,MAAM,IAAA,yBAAY,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClD,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,MAAM,IAAA,yBAAY,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClD,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrF,MAAM,IAAA,yBAAY,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,IAAA,eAAM,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CACvC,eAAM,CAAC,gBAAgB,CAAC,cAAc,CAAC,EACvC,CAAC,aAAa,CAAC,CAChB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,IAAA,iBAAQ,EAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,IAAA,WAAE,EAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,MAAM,GAAG,UAAU,CAAC;YACxB,YAAY,EAAE;gBACZ,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;gBAC9D,QAAQ,EAAE,CAAC;aACZ;SACF,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAA,8BAAiB,EAAC,MAAM,CAAC,CAAC;QAChD,IAAA,eAAM,EAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,MAAM,GAAG,UAAU,CAAC;YACxB,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE;SACxC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAA,8BAAiB,EAAC,MAAM,CAAC,CAAC;QAChD,IAAA,eAAM,EAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,IAAA,iBAAQ,EAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,IAAA,WAAE,EAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,IAAA,mCAAsB,EAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;QAC9D,IAAA,eAAM,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CACvC,kFAAkF,CACnF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,IAAA,eAAM,EACV,IAAA,mCAAsB,EAAC,MAAM,EAAE,8BAA8B,EAAE,aAAa,CAAC,CAC9E,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,IAAA,eAAM,EACV,IAAA,mCAAsB,EAAC,MAAM,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAC5D,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/adapters/database-prisma.d.ts

@@ -0,0 +1,50 @@
+import { DatabasePoolManager } from "../database/pool-manager.js";
+interface PrismaClientLike {
+    $extends: (extension: unknown) => PrismaClientLike;
+    $executeRaw: (query: TemplateStringsArray, ...values: unknown[]) => Promise<number>;
+    $transaction: <T>(fn: (tx: PrismaClientLike) => Promise<T>) => Promise<T>;
+    $connect: () => Promise<void>;
+    $disconnect: () => Promise<void>;
+}
+type PrismaConstructor = new (options: {
+    datasources: {
+        db: {
+            url: string;
+        };
+    };
+}) => PrismaClientLike;
+/**
+ * Prisma adapter for DB_PER_TENANT isolation.
+ *
+ * Creates a Prisma client instance scoped to the tenant's dedicated database
+ * by overriding the datasource URL with the per-tenant database name.
+ *
+ * Usage:
+ *   const adapter = new DatabasePrismaAdapter(poolManager, PrismaClient, baseUrl);
+ *   const prisma = adapter.getClient('acme_corp');
+ *   const rows = await prisma.someModel.findMany();
+ */
+export declare class DatabasePrismaAdapter {
+    private readonly poolManager;
+    private readonly PrismaClient;
+    private readonly baseDatasourceUrl;
+    private readonly clients;
+    constructor(poolManager: DatabasePoolManager, PrismaClient: PrismaConstructor, baseDatasourceUrl: string);
+    /**
+     * Returns a Prisma client connected to the tenant's dedicated database.
+     * Clients are cached per tenant slug; call disconnect() to free resources.
+     */
+    getClient(tenantSlug: string): PrismaClientLike;
+    /** Disconnects and removes the cached Prisma client for the given tenant. */
+    disconnectClient(tenantSlug: string): Promise<void>;
+    /** Disconnects all cached Prisma clients. Call during application shutdown. */
+    disconnectAll(): Promise<void>;
+    /**
+     * Replaces the database name in a PostgreSQL connection URL.
+     * Handles both connection string formats:
+     *   postgres://user:pass@host:port/dbname[?params]
+     */
+    private buildDatasourceUrl;
+}
+export {};
+//# sourceMappingURL=database-prisma.d.ts.map

package/dist/adapters/database-prisma.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-prisma.d.ts","sourceRoot":"","sources":["../../src/adapters/database-prisma.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAGlE,UAAU,gBAAgB;IACxB,QAAQ,EAAE,CAAC,SAAS,EAAE,OAAO,KAAK,gBAAgB,CAAC;IACnD,WAAW,EAAE,CACX,KAAK,EAAE,oBAAoB,EAC3B,GAAG,MAAM,EAAE,OAAO,EAAE,KACjB,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,gBAAgB,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1E,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED,KAAK,iBAAiB,GAAG,KAAK,OAAO,EAAE;IAAE,WAAW,EAAE;QAAE,EAAE,EAAE;YAAE,GAAG,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAA;CAAE,KAAK,gBAAgB,CAAC;AAErG;;;;;;;;;;GAUG;AACH,qBAAa,qBAAqB;IAI9B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IALpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4C;gBAGjD,WAAW,EAAE,mBAAmB,EAChC,YAAY,EAAE,iBAAiB,EAC/B,iBAAiB,EAAE,MAAM;IAG5C;;;OAGG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,gBAAgB;IAe/C,6EAA6E;IACvE,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOzD,+EAA+E;IACzE,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAMpC;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;CAI3B"}

package/dist/adapters/database-prisma.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DatabasePrismaAdapter = void 0;
+/**
+ * Prisma adapter for DB_PER_TENANT isolation.
+ *
+ * Creates a Prisma client instance scoped to the tenant's dedicated database
+ * by overriding the datasource URL with the per-tenant database name.
+ *
+ * Usage:
+ *   const adapter = new DatabasePrismaAdapter(poolManager, PrismaClient, baseUrl);
+ *   const prisma = adapter.getClient('acme_corp');
+ *   const rows = await prisma.someModel.findMany();
+ */
+class DatabasePrismaAdapter {
+    poolManager;
+    PrismaClient;
+    baseDatasourceUrl;
+    clients = new Map();
+    constructor(poolManager, PrismaClient, baseDatasourceUrl) {
+        this.poolManager = poolManager;
+        this.PrismaClient = PrismaClient;
+        this.baseDatasourceUrl = baseDatasourceUrl;
+    }
+    /**
+     * Returns a Prisma client connected to the tenant's dedicated database.
+     * Clients are cached per tenant slug; call disconnect() to free resources.
+     */
+    getClient(tenantSlug) {
+        const existing = this.clients.get(tenantSlug);
+        if (existing)
+            return existing;
+        const dbName = `stratum_tenant_${tenantSlug}`;
+        const tenantUrl = this.buildDatasourceUrl(this.baseDatasourceUrl, dbName);
+        const client = new this.PrismaClient({
+            datasources: { db: { url: tenantUrl } },
+        });
+        this.clients.set(tenantSlug, client);
+        return client;
+    }
+    /** Disconnects and removes the cached Prisma client for the given tenant. */
+    async disconnectClient(tenantSlug) {
+        const client = this.clients.get(tenantSlug);
+        if (!client)
+            return;
+        this.clients.delete(tenantSlug);
+        await client.$disconnect();
+    }
+    /** Disconnects all cached Prisma clients. Call during application shutdown. */
+    async disconnectAll() {
+        const entries = Array.from(this.clients.entries());
+        this.clients.clear();
+        await Promise.all(entries.map(([, client]) => client.$disconnect()));
+    }
+    /**
+     * Replaces the database name in a PostgreSQL connection URL.
+     * Handles both connection string formats:
+     *   postgres://user:pass@host:port/dbname[?params]
+     */
+    buildDatasourceUrl(baseUrl, dbName) {
+        // Replace the database portion of the URL (last path segment before query string).
+        return baseUrl.replace(/\/[^/?]+(\?|$)/, `/${dbName}$1`);
+    }
+}
+exports.DatabasePrismaAdapter = DatabasePrismaAdapter;
+//# sourceMappingURL=database-prisma.js.map

package/dist/adapters/database-prisma.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-prisma.js","sourceRoot":"","sources":["../../src/adapters/database-prisma.ts"],"names":[],"mappings":";;;AAgBA;;;;;;;;;;GAUG;AACH,MAAa,qBAAqB;IAIb;IACA;IACA;IALF,OAAO,GAAkC,IAAI,GAAG,EAAE,CAAC;IAEpE,YACmB,WAAgC,EAChC,YAA+B,EAC/B,iBAAyB;QAFzB,gBAAW,GAAX,WAAW,CAAqB;QAChC,iBAAY,GAAZ,YAAY,CAAmB;QAC/B,sBAAiB,GAAjB,iBAAiB,CAAQ;IACzC,CAAC;IAEJ;;;OAGG;IACH,SAAS,CAAC,UAAkB;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,MAAM,GAAG,kBAAkB,UAAU,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAE1E,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,YAAY,CAAC;YACnC,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE;SACxC,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,gBAAgB,CAAC,UAAkB;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChC,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;IAC7B,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,aAAa;QACjB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;;OAIG;IACK,kBAAkB,CAAC,OAAe,EAAE,MAAc;QACxD,mFAAmF;QACnF,OAAO,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,MAAM,IAAI,CAAC,CAAC;IAC3D,CAAC;CACF;AApDD,sDAoDC"}

package/dist/adapters/database-raw.d.ts

@@ -0,0 +1,23 @@
+import pg from "pg";
+import { DatabasePoolManager } from "../database/pool-manager.js";
+/**
+ * Raw SQL adapter for DB_PER_TENANT isolation.
+ *
+ * Each query is routed to the dedicated database for the given tenant slug
+ * by obtaining a connection from the tenant's pool via DatabasePoolManager.
+ */
+export declare class DatabaseRawAdapter {
+    private readonly poolManager;
+    constructor(poolManager: DatabasePoolManager);
+    /**
+     * Executes a single query against the tenant's dedicated database.
+     * The connection is acquired and released automatically.
+     */
+    query<T extends pg.QueryResultRow = pg.QueryResultRow>(tenantSlug: string, text: string, values?: unknown[]): Promise<pg.QueryResult<T>>;
+    /**
+     * Executes a callback inside an explicit transaction against the tenant's dedicated database.
+     * The transaction is automatically committed on success and rolled back on error.
+     */
+    executeWithTenantContext<T>(tenantSlug: string, queryFn: (client: pg.PoolClient) => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=database-raw.d.ts.map

package/dist/adapters/database-raw.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-raw.d.ts","sourceRoot":"","sources":["../../src/adapters/database-raw.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE;;;;;GAKG;AACH,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,mBAAmB;IAE7D;;;OAGG;IACG,KAAK,CAAC,CAAC,SAAS,EAAE,CAAC,cAAc,GAAG,EAAE,CAAC,cAAc,EACzD,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAU7B;;;OAGG;IACG,wBAAwB,CAAC,CAAC,EAC9B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,GAC7C,OAAO,CAAC,CAAC,CAAC;CAed"}